Ensure that the --rotate-certificates argument is not set to false (Kubelet) (Openshift)

Enable kubelet client certificate rotation.

Risk Level: Informational
Cloud Entity: Node
CloudGuard Rule ID: D9.K8S.CRY.42
Covered by Spectral: No
Category: Compute

GSL LOGIC

KubernetesNode should have kubeletData.kubeletconfig.rotateCertificates= 'true'

REMEDIATION

None required.

References

  1. https://docs.openshift.com/container-platform/4.5/architecture/control-plane.html#understanding-machine-config-operator_control-plane
  2. https://github.com/openshift/kubernetes-kubelet/blob/origin-4.5-kubernetes-1.18.3/config/v1beta1/types.go#L172-L181
  3. https://github.com/openshift/machine-config-operator/blob/release-4.5/templates/master/01-master-kubelet/_base/files/kubelet.yaml
  4. https://github.com/openshift/machine-config-operator/blob/release-4.5/templates/worker/01-worker-kubelet/_base/files/kubelet.yaml
  5. https://github.com/kubernetes/kubernetes/pull/41912
  6. https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/#kubelet-configuration
  7. https://kubernetes.io/docs/imported/release/notes/
  8. https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/

Node

A node is a worker machine in Kubernetes, previously known as a minion. A node may be a VM or physical machine, depending on the cluster. Each node contains the services necessary to run pods and is managed by the master components. The services on a node include the container runtime, kubelet and kube-proxy.

Compliance Frameworks

  • CIS OpenShift Container Platform v4 Benchmark v1.1.0
  • CIS OpenShift Container Platform v4 Benchmark v1.4.0
  • OpenShift Container Platform v3